Skip to content

Vendor

oscommerce vulnerabilities

100 published CVES affecting oscommerce, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
100
Critical
5
High
18
Medium
76
Low
1
Unscored
0
CISA KEV
0
Atom feed of oscommerce alerts

Products

Latest oscommerce CVEs

Newest publication first · page 1 of 4

  2. CVE-2026-105225 osCommerce osCommerce2 Payment payment.php include code injection

    Published
    MediumCVSS 4.8 EPSS 0.19%

    A vulnerability was identified in osCommerce osCommerce2 up to 2.3.4.1. This affects the function include of the file includes/classes/payment.php of the component Payment Page. Such manipulation of the argument MODULE_PAYMENT_INSTALLED leads to code injection. The attack can be...

  4. CVE-2019-25497 osCommerce 2.3.4.1 SQL Injection via currency Parameter

    Published
    HighCVSS 8.8 EPSS 0.37%

    osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the currency parameter. Attackers can send GET requests to shopping_cart.php with malicious currency values using boolean-b...

  5. CVE-2019-25496 osCommerce 2.3.4.1 SQL Injection via products_id Parameter

    Published
    HighCVSS 8.8 EPSS 0.37%

    osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the products_id parameter. Attackers can modify the products_id value in product_info.php requests and append boolean-based...

  6. CVE-2019-25495 osCommerce 2.3.4.1 SQL Injection via reviews_id Parameter

    Published
    HighCVSS 8.8 EPSS 0.37%

    osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the reviews_id parameter. Attackers can send GET requests to product_reviews_write.php with malicious reviews_id values usi...

  7. CVE-2009-20006 osCommerce <= 2.2 Admin File Manager Arbitrary PHP Code Execution

    Published
    CriticalCVSS 9.3 EPSS 2.3% Framework module

    osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility (admin/file_manager.php). The interface allows file uploads and edits without sufficient input validation or access control. An unauthenticated attacker can craft a...

  9. CVE-2025-40674 Reflected Cross-Site Scripting (XSS) in osCommerce

    Published
    MediumCVSS 5.1 EPSS 0.49%

    Reflected Cross-Site Scripting (XSS) in osCommerce v4. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the name of any parameter in /watch/en/about-us. This vulnerability can be exploited to stea...

  10. CVE-2024-4348 osCommerce all-products cross site scripting

    Published
    MediumCVSS 4.3 EPSS 1.8%

    A vulnerability, which was classified as problematic, was found in osCommerce 4. Affected is an unknown function of the file /catalog/all-products. The manipulation of the argument cat leads to cross site scripting. It is possible to launch the attack remotely. The exploit has be...

  14. CVE-2023-6609 osCommerce all-products cross site scripting

    Published
    MediumCVSS 6.1 EPSS 0.41%

    A vulnerability was found in osCommerce 4. It has been classified as problematic. This affects an unknown part of the file /b2b-supermarket/catalog/all-products. The manipulation of the argument keywords with the input %27%22%3E%3Cimg%2Fsrc%3D1+onerror%3Dalert%28document.cookie%2...

  15. CVE-2023-6579 osCommerce POST Parameter shopping-cart sql injection

    Published
    CriticalCVSS 9.8 EPSS 24.0%

    A vulnerability, which was classified as critical, has been found in osCommerce 4. Affected by this issue is some unknown functionality of the file /b2b-supermarket/shopping-cart of the component POST Parameter Handler. The manipulation of the argument estimate[country_id] leads...

  16. CVE-2023-6296 osCommerce Instant Message compare cross site scripting

    Published
    MediumCVSS 6.1 EPSS 0.80%

    A vulnerability was found in osCommerce 4. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /catalog/compare of the component Instant Message Handler. The manipulation of the argument compare with the input 40dz4iq"><script>alert(...

  17. CVE-2023-5112 Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

    Published
    MediumCVSS 5.4 EPSS 0.46%

    Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "specials_type_name[1]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

  18. CVE-2023-5111 Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

    Published
    MediumCVSS 5.4 EPSS 0.46%

    Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "featured_type_name[1]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

  25. CVE-2023-43729 Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)

    Published
    MediumCVSS 5.4 EPSS 0.46%

    Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "xsell_type_name[1]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.